My fault.  @indutny asked for the list of keys I strip, and I mis-remembered.  This is the list:

```javascript
  delete doc.password_sha
  delete doc.salt
  delete doc.password_scheme
  delete doc.derived_key
  delete doc.iterations
  delete doc['x-csrf-token']
```